Skip to content

DNSControl

v4.38.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 20d Infrastructure as Code
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

dns dnscontrol go iac

Affected surfaces

auth rbac deps

ReleasePort's take

Moderate signal
editorial:auto 9d

`dnscontrol get-zones` has dropped support for older syntax, altering its behavior.

Why it matters: If your automation relies on the deprecated `dnscontrol get-zones` syntax, update scripts before upgrading to v4.38.0; severity flagged as high (80).

Summary

AI summary

dnscontrol get-zones no longer supports older syntax.

Changes in this release

Breaking High

`dnscontrol get-zones` drops older syntax support, changing behavior

`dnscontrol get-zones` drops older syntax support, changing behavior

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

 —
Breaking Medium

REV() will switch from RFC2317 to RFC4183 in v5.0, a breaking change for affected configurations

REV() will switch from RFC2317 to RFC4183 in v5.0, a breaking change for affected configurations

Source: llm_adapter@2026-05-21

Confidence: low

 —
Feature Medium

`dnscontrol init` is an interactive experience that helps new users build their configuration

`dnscontrol init` is an interactive experience that helps new users build their configuration

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

Route53 now supports weighted routing and health checks via DNSControl

Route53 now supports weighted routing and health checks via DNSControl

Source: llm_adapter@2026-05-21

Confidence: low

 —
Feature Medium

LUADNS now supports OPENPGPKEY record type

LUADNS now supports OPENPGPKEY record type

Source: llm_adapter@2026-05-21

Confidence: low

 —
Dependency Medium

Dependencies updated across the codebase

Dependencies updated across the codebase

Source: llm_adapter@2026-05-21

Confidence: low

 —
Dependency Low

Multiple dependency updates applied across the codebase

Multiple dependency updates applied across the codebase

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

 —
Performance Medium

`dnscontrol preview` output for TXT records is easier to read

`dnscontrol preview` output for TXT records is easier to read

Source: llm_adapter@2026-05-21

Confidence: low

 —
Performance Low

`dnscontrol preview` renders TXT records as a single string for readability

`dnscontrol preview` renders TXT records as a single string for readability

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

 —
Deprecation Medium

NAMEDOTCOM, OPENSRS, and SOFTLAYER providers need maintainers

NAMEDOTCOM, OPENSRS, and SOFTLAYER providers need maintainers

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

`dnscontrol get-zones` no longer supports older syntax, reducing confusion

`dnscontrol get-zones` no longer supports older syntax, reducing confusion

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

`LOC` records fixed on 32-bit CPUs

`LOC` records fixed on 32-bit CPUs

Source: llm_adapter@2026-05-21

Confidence: low

 —
Full changelog

Greetings DNS fans!

This is our first feature release since DNSControl's move to the new GitHub org. It is now complete. Thanks to all the volunteers that helped make that move possible!

This is a huge release with many new features due to the backlog of contributions that were waiting for the big move to complete.

I'm particularly excited about the new dnscontrol init command, contributed by @cafferata. It is an interactive experience that helps new users build their configuration. I expect this will greatly help increase adoption of DNSControl. However we need a little help: Each DNS provider needs to update their provider to be included in the menu (we'll have more news soon).

  • NEW PROVIDER MAINTAINER! Applause all around to @natalie-o-perret for stepping up to be the maintainer of the EXOSCALE provider. We look forward to great things!
  • ROUTE53 users can now control a weighted routing and health check via DNSControl (Thanks @Crazu!)
  • LOC records were broken on 32-bit CPUs (Thanks @al20ov!)
  • dnscontrol init is an interactive experience that helps new users build their configuration (Thanks @cafferata!)
  • dnscontrol get-zones no longer supports older syntax, and is less confusing as a results (Thanks @cafferata!)
  • dnscontrol preview output forTXT records is easier to read (Thanks @raman1236!)
  • LUADNS now supports OPENPGPKEY (Thanks @riku22!)
  • PRs are now automatically assigned (Thanks @chicks-net)
  • Adding new providers has fewer manual steps (yay!) (Thanks @cafferata!)
  • Old code that used parser.ParseDir has been replaced (Thanks @philpennock!)
  • Bug fixes and improvements for AXFRDDNS, CLOUDFLAREAPI, CLOUDNS, DNSCALE, EXOSCALE, GIDINET, INFOMANIAK, POWERDNS, UNIFI.
  • And much, much, more!

Thanks to all contributors involved in this release! This is a community project and we couldn't do it without all of your contributions!

Sincerely,
--Tom Limoncelli

Monthly video call!

Everyone is invited to the Monthly DNSControl Community Video Conference Call on the 2nd Tuesday of each month. Join whether you are a new user with questions or an experienced developer that wants to discuss DNSControl internals... or anything in between! Meeting details on
GitHub Discussions.

Changelog

Major features:

  • a79e872ee4f8afbeb12b5d9e69c1db5185f29309: FEATURE: Init command (#4208) (@cafferata)

Provider-specific changes:

  • 7ec4cb34c8b7c43101ed074ccdebdd9f6edf39ea: AXFRDDNS: Add missing ALPN token 'dot' (#4207) (@Mr-Foo)
  • c09090b154e2ccd34bc7aa3318af7beb8cc30d01: CLOUDFLAREAPI: allow CNAME + other records when Cloudflare proxy is enabled (#4189) (@raman1236)
  • 72bce2af39f7419aaee23a8807e7393631e980d5: DNSCALE: allow third-party NS records at zone apex (#4176) (@dnscale-ops)
  • 0b4d6fd2952c179b43a34e13d5c493addbd659dd: EXOSCALE: migrate to egoscale v3 (#4224) (@natalie-o-perret)
  • c93f116f5e46a21db411bc74645f9c8199643174: GIDINET: Auto-suggest nameservers and add premium DNS helper (#4203) (@zupolgec)
  • f8e6f21b74265022594aa714894d581375c8a5ee: INFOMANIAK: report invalid API token rather than claim all records disappeared (#4200) (@signalwerk)
  • b55ad7900e1f259f7865c0bde4a680cb83e15c05: LINODE: Add Linode integration test support (#4244) (@labrown)
  • af9a220570fa12350a76bb2417130d257dc83a7b: LUADNS: support OPENPGPKEY record type (#4249) (@riku22)
  • bc4119b6fb385a717cb7349a6a631f3247e6234a: POWERDNS: Fix DNSSEC corrections handling for unset AutoDNSSEC (#4248) (@jpbede)
  • 3770218a166de3c032e6d1de45ffd49a334cfa2f: ROUTE53: Add weighted routing and health check support (#4175) (@Crazu)
  • 9944f975454e75544e3d78e88c5e7b1cf1aabe2d: UNIFI: fix errors on version 10.2.105 (#4201) (@Matthew-Kilpatrick)
  • 4df0c764ffe61a1751ab93a82c70915b3e5ae70d: fix(cloudns): map CLOUD_WR to CLOUDNS_WR so redirect records are not recreated every push (#4188) (@raman1236)

Documentation:

  • f640d761cf159279e5e19359e567f7f03d86c2a5: DOCS: Fixed 404 account URL in INWX documentation (#4169) (@cafferata)
  • 91282bb8eb0a84bc7b1acd50bcdd4a719596bf9c: DOCS: POWERDNS SOA documentation (#4028) (@flindeberg)
  • e47eda900b93c68f2637d777356d5908fee81831: DOCS: Unwrap hard-wrapped paragraphs in GitBook documentation (#4225) (@cafferata)
  • 1ad739e7be41c7cba2fd111f20fbced421104661: DOCS: Update SendSafely instructions (#4254) (@TomOnTime)

CI/CD:

  • af896ac19adc9480f87463ff6f8facb570aa13e9: BUILD: Eliminate the need to manually update GoReleaser for new providers (#4255) (@cafferata)
  • 2dbde3ee06a028580a8db0a482a9dd501b672189: CICD: Derive integration test provider list from profiles.json (#4245) (@cafferata)
  • f6a006887a0c24f39030090cf2931c39da9e3c1c: CICD: Move OWNERS to .github/CODEOWNERS to fix #3978 (#3983) (@chicks-net)
  • fca753cf7cbdb76fb32e766a5736cf8b3ab64e5f: CICD: only release in DNSControl/dnscontrol repo, fixes #4238 (#4239) (@chicks-net)

Dependencies:

  • cd036909ffe2e7bbeccfd13279b5f7a0a2bbcf0a: CHORE: Update dependencies (#4257) (@TomOnTime)
  • 0b0f92cfdb233cf4d434a25af56ddbaf461bcb0a: CHORE: Update dependencies, etc (#4242) (@TomOnTime)

Other changes and improvements:

  • 1e599ca012263e33369c398cdc784f20e507f1b7: BUG: Fix get-zones argument parsing to match documentation (#4240) (@cafferata)
  • 44b3486c6fb47f324fca37ff420665528b4dee40: BUG: TypeScript definition of TXT is incorrect (#4199) (@dasyad00)
  • 59d7a9702855207980498617f7d224a77d79f9b6: BUGFIX: LOC record latitude/longitude overflow on 32 bit archs (#4194) (@al20ov)
  • 0682d088d9015139c91b1c9cb0d77cc88c645fb3: BUGFIX: preview should display long TXT records as one string (#4190) (@raman1236)
  • dae9d96f40907bf6d9034a2ea819242c88f561e1: CHORE: Add CODEOWNERS for documentation and GoReleaser config (#4256) (@cafferata)
  • 590caea7ebf343c059db870073c883c5982126ed: CHORE: Fix lint issues (#4252) (@TomOnTime)
  • 1132bedcf98c8ab949d4885af8208c5dd469b345: CHORE: Replace parser.ParseDir with golang.org/x/tools/go/packages (#4195) (@philpennock)

Deprecation warnings

[!WARNING]

  • REV() will switch from RFC2317 to RFC4183 in v5.0. This is a breaking change. Warnings are output if your configuration is affected. No date has been announced for v5.0. See https://docs.dnscontrol.org/language-reference/top-level-functions/revcompat
  • NAMEDOTCOM, OPENSRS and SOFTLAYER need maintainers! These providers have no maintainer. Maintainers respond to PRs and fix bugs in a timely manner, and try to stay on top of protocol changes.

Install

macOS and Linux

Install with Homebrew (recommended)
brew install DNSControl/tap/dnscontrol
Using with Docker

You can use the Docker image from Docker hub or GitHub Container Registry.

docker run --rm -it -v "$(pwd):/dns" ghcr.io/dnscontrol/dnscontrol preview

Anywhere else

Alternatively, you can install the latest binary (or the apt/rpm/deb/archlinux package) from this page.

Or, if you have Go installed, you can install the latest version of DNSControl with the following command:

go install github.com/DNSControl/dnscontrol/v4@main

Update

Update to the latest version depends on how you choose to install dnscontrol on your machine.

Update with Homebrew

brew upgrade DNSControl/tap/dnscontrol

Alternatively, you can grab the latest binary (or the apt/rpm/deb package) from this page.

Breaking Changes

  • `dnscontrol get-zones` no longer supports older syntax
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track DNSControl

Get notified when new releases ship.

Sign up free

About DNSControl

Infrastructure as code for DNS!

All releases →

Related context

Earlier breaking changes

  • v4.41.0 REV() will switch from RFC2317 to RFC4183 in v5.0 (breaking change)
  • v4.40.0 REV() will switch from RFC2317 to RFC4183 in upcoming v5.0 (breaking change)
  • v4.39.0 REV() will switch from RFC2317 to RFC4183 in v5.0, a breaking change.

Beta — feedback welcome: [email protected]